🇺🇸
TPI-Abuse
2024-03-30 03:37:53
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 84.32.71.101 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 84.32.71.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 29 23:37:48.231143 2024] [security2:error] [pid 20039] [client 84.32.71.101:50941] [client 84.32.71.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pigspolygon.xyz"] [uri "/backup/.env"] [unique_id "ZgeJDIWlOoQVK4oRM7xdGgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-03-21 13:24:06
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 84.32.71.101 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 84.32.71.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 21 09:23:58.868146 2024] [security2:error] [pid 8078] [client 84.32.71.101:21423] [client 84.32.71.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mjkhan.com"] [uri "/backup/sftp-config.json"] [unique_id "Zfw07nx-tmx8-dGAC6NYHAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-03-15 15:25:47
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 84.32.71.101 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 84.32.71.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 15 11:25:43.598187 2024] [security2:error] [pid 107165:tid 47759626516224] [client 84.32.71.101:30927] [client 84.32.71.101] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||dpscsde.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dpscsde.com"] [uri "/restore/mysql.sql"] [unique_id "ZfRodzlHK4ZcrAqk5sfzIQAAAVE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
unifr
2024-02-18 10:08:24
(2 years ago)
Unauthorized IMAP connection attempt
Brute-Force
🇩🇪
hbrks
2024-02-08 23:48:48
(2 years ago)
HEAD http://epay.world/backup/directory.tar
statusCode: 503
Web Spam
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2024-02-05 03:32:23
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 84.32.71.101 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 84.32.71.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 04 22:32:15.742896 2024] [security2:error] [pid 32402] [client 84.32.71.101:61307] [client 84.32.71.101] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||hodlmoser.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "hodlmoser.com"] [uri "/backup/backup.sql"] [unique_id "ZcBWvwSlUv7Px3f_T5e4iAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-01-29 12:07:14
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 84.32.71.101 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 84.32.71.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 29 07:07:08.994614 2024] [security2:error] [pid 24209] [client 84.32.71.101:16275] [client 84.32.71.101] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||usbea.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "usbea.com"] [uri "/bak/usbea.com.sql"] [unique_id "ZbeU7MhSDHerVLsug35-DwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-01-21 10:19:03
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 84.32.71.101 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 84.32.71.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 21 05:18:55.082461 2024] [security2:error] [pid 1440] [client 84.32.71.101:55759] [client 84.32.71.101] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||boat-accessories.net|F|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "boat-accessories.net"] [uri "/restore/wallet.dat"] [unique_id "ZazvjxYosCybr1OU7gTl4gAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇱
FAZ_Noc
2023-12-19 07:09:50
(2 years ago)
SQL injection - Unauthorized connection attempt detected from IP address
SQL Injection
🇺🇸
Staging
2023-11-04 08:27:13
(2 years ago)
Automated report (2023-11-04T10:27:13+02:00). Caught probing for unsecured backup files.
Hacking